CN107409128A - Techniques for Secure Server Access Using Trusted License Brokers - Google Patents

Abstract

Techniques for secure server access include a client computing device loading a license agent into a secure enclave established by a processor of the client computing device. The license agent receives a request from an application to access a remote server device. The license agent opens a secure connection with the server device and performs remote attestation of the secure enclave. The license agent authenticates the user and sends the machine identifier and the user identifier to the server device. The machine identifier may be based on an enclave sealing key of the client computing device. The server device verifies that the machine identifier and the user identifier are bound to a valid application license. If the machine identifier and the user identifier are successfully verified, the application communicates with the server device using the secure connection. Other embodiments are also described and claimed.

Description

Techniques for Secure Server Access Using Trusted License Brokers

Cross References to Related Applications

This application claims priority to US Utility Patent Application 14/670,959, filed March 27, 2015, entitled "TECHNOLOGIES FOR SECURE SERVERACCESS USING A TRUSTED LICENSE AGENT."

Background technique

Many modern computing applications include online features that allow applications to access data stored on remote servers. For example, multiplayer games can access remote servers, and many content applications can also access remote servers. Service providers may charge for access to online data, allowing client applications to be authenticated. A typical solution creates a trusted communication channel between a client device and a remote server, for example using a secure network connection. However, the client application may be an ordinary, unprotected client application executed by the client device, so the server may not be able to guarantee the authenticity of the client application.

Description of drawings

The concepts described herein are illustrated in the drawings by way of example and not limitation. For simplicity and clarity of illustration, elements shown in the figures have not necessarily been drawn to scale. Where appropriate, reference labels have been repeated among the figures to indicate corresponding or analogous elements.

Figure 1 is a simplified block diagram of at least one embodiment of a system for secure server access;

Figure 2 is a simplified block diagram of at least one embodiment of various environments that may be established by the system of Figure 1;

Figure 3 is a simplified flowchart of at least one embodiment of a method for secure server access that may be performed by a client computing device of the systems of Figures 1 and 2; and

4 is a simplified flowchart of at least one embodiment of a method for secure server access that may be performed by a server device of the systems of FIGS. 1 and 2 .

detailed description

While the concepts of the present disclosure are susceptible to various modifications and alternative forms, specific embodiments thereof have been shown by way of example in the drawings and will be described in detail herein. It should be understood, however, that there is no intent to limit the disclosed concepts to the particular forms disclosed, but on the contrary, the invention is to cover all modifications, equivalents, and alternatives consistent with the disclosure and appended claims.

References in the specification to "one embodiment," "an embodiment," "illustrative embodiment," etc., indicate that the described embodiment may include a particular feature, structure, or characteristic, but that each embodiment may or may not necessarily include A particular characteristic, structure, or characteristic. Moreover, such phrases are not necessarily referring to the same embodiment. Furthermore, when a particular feature, structure or characteristic is described in conjunction with an embodiment, it is considered to be within the scope of those skilled in the art to implement such feature, structure or characteristic in combination with other embodiments whether or not explicitly described. Additionally, it should be understood that inclusion of items in the list in the form "at least one of A, B, and C" may mean (A); (B); (C); (A and B); (A and C); (B and C); or (A, B and C). Similarly, an item listed in the form "at least one of A, B, or C" may mean (A); (B); (C); (A and B); (A and C); (B and C); or (A, B and C).

In some cases, the disclosed embodiments may be implemented in hardware, firmware, software, or any combination thereof. The disclosed embodiments can also be implemented as instructions carried or stored on a transitory or non-transitory machine-readable (eg, computer-readable) storage medium that can be read and executed by one or more processors. A machine-readable storage medium can be implemented as any storage device, mechanism, or other physical structure.

In the drawings, some structural or methodological features may be shown in a particular arrangement and/or order. However, it should be understood that this specific arrangement and/or ordering may not be required. Rather, in some embodiments, features may be arranged in a different manner and/or order than shown in the illustrative figures. Additionally, the inclusion of structural or methodological features in a particular figure does not imply that such features are required in all embodiments, and in some embodiments these features may not be included or may be combined with other features.

Referring now to FIG. 1 , in an illustrative embodiment, a system 100 for secure server access includes a number of client computing devices 102 and a server device 104 that communicate over a network 106 . In use, as described in more detail below, each client computing device 102 loads a trusted license agent into a secure enclave protected by a processor of the respective client computing device 102 . In use, the trusted license agent receives requests from applications executed by client computing devices 102 to access applications and/or data provided by server devices 104 . A trusted license agent executing within the secure address space opens a secure connection with the server device 104 and performs a remote attestation process to prove that the secure address space (and thus the license agent) is intact and authentic. After remote attestation, the trusted license agent sends the machine identifier and user identifier associated with the client computing device 102 to the server device 104, and the server device 104 determines whether the combination of user and machine is allowed to access the application and/or data. If access is permitted, the application of the client computing device 102 accesses the server device 104 through a secure connection established by the trusted license broker. Thus, system 100 allows server device 104 to restrict access to applications to specific combinations of machines and users. In addition, server device 104 verifies the integrity of applications executed by client computing device 102, which may prevent access by unauthorized clients (e.g., by preventing access to client applications that have been modified or otherwise compromised) ).

Each client computing device 102 may embody any type of computing or computer device capable of performing the functions described herein, including but not limited to computers, desktop computers, workstations, laptop computers, notebook computers, tablet computers, mobile computing devices , wearable computing devices, networking devices, web devices, distributed computing systems, processor-based systems and/or consumer electronic devices. As shown in FIG. 1 , client computing device 102 illustratively includes processor 120 , input/output subsystem 124 , memory 126 , data storage device 128 , and communication circuitry 130 . Of course, in other embodiments, client computing device 102 may include other or additional components, such as those commonly found in desktop computers (eg, various input/output devices). Additionally, in some embodiments, one or more illustrative components may incorporate or otherwise form part of another component. For example, memory 126 , or portions thereof, may be incorporated into one or more processors 120 in some embodiments.

Processor 120 may be implemented as any type of processor capable of performing the functions described herein. Processor 120 may be implemented as a single-core or multi-core processor, digital signal processor, microcontroller, or other processor or processing/control circuitry. In some embodiments, processor 120 includes secure address space support 122 . Secure address space support 122 allows processor 120 to establish a trusted execution environment, referred to as a secure address space, in which executing code can be measured, verified, and/or otherwise determined to be authentic. Additionally, code and data included in the secure address space may be encrypted or otherwise protected from access by code executing outside the secure address space. For example, code and data included in a secure address space may be protected by hardware protection mechanisms of the processor 120 while being executed or stored in a specific protected cache memory of the processor 120 . Code and data included in the secure address space may be encrypted while stored in shared cache or main memory 126 . Secure address space support 122 may be implemented as a set of processor instruction extensions that allow processor 120 to establish one or more secure address spaces in memory 126 . For example, secure address space support 122 may be embodied as Software Guard Extensions (SGX) technology.

Memory 126 may be implemented as any type of volatile or non-volatile memory or data storage capable of performing the functions described herein. In operation, memory 126 may store various data and software used during operation of client computing device 102 , such as operating systems, applications, programs, libraries, and drivers. Memory 126 is communicatively coupled to processor 120 via I/O subsystem 124, which may be implemented to facilitate input/output operations with processor 120, memory 126, and other components of client computing device 102. circuits and/or components. For example, I/O subsystem 124 may be implemented or otherwise include a memory controller hub, an input/output control hub, firmware devices, communication links (i.e., point-to-point links, bus links, wires, cables , light guides, printed circuit board traces, etc.) and/or other components and subsystems to facilitate input/output operations. In some embodiments, I/O subsystem 124 may form part of a system on a chip (SoC) and be incorporated on a single integrated circuit chip along with processor 120 , memory 126 and other components of client computing device 102 .

Data storage device 128 may be implemented as any type of device or devices configured for short-term or long-term storage of data, such as memory devices and circuits, memory cards, hard drives, solid-state drives, or other data storage devices. In some embodiments, data storage device 128 may be used to store the contents of one or more secure address spaces. When stored by data storage device 128, the contents of the secure address space may be encrypted to prevent unauthorized access.

Communication circuitry 130 of client computing device 102 may be implemented as any communication circuit, device, or collection thereof that enables communication between client computing device 102, server device 104, and/or other remote devices over network 106. Communications circuitry 130 may be configured to use any one or more communications technologies (e.g., wired or wireless communications) and associated protocols (e.g., Ethernet, WiMAX, etc.) to realize such communication.

The server device 104 is configured to authenticate and provide application services and/or data to the trusted license broker of each client computing device 102 . Server device 104 may be implemented as any type of computing or computer device capable of performing the functions described herein, including but not limited to computers, multi-processor systems, servers, rack servers, blade servers, laptops, notebooks Computers, tablet computers, wearable computing devices, networking devices, web devices, distributed computing systems, processor-based systems and/or consumer electronics devices. Illustratively, server device 104 includes processor 140, I/O subsystem 142, memory 144, data storage device 146, communication circuitry 148, and/or other components and devices typically found in a server or similar computing device. These individual components of server device 104 may be similar to corresponding components of client computing device 102, which description applies to corresponding components of server device 104 and are not repeated herein so as not to obscure the present disclosure. Additionally, in some embodiments, server device 104 may be implemented as a "virtual server" formed from multiple computing devices distributed across network 106 and operating in a public or private cloud. Thus, while server device 104 is shown in FIG. 1 as being implemented as a single server computing device, it should be understood that server device 104 may be implemented as multiple devices that cooperate to facilitate the functions described below.

As discussed in more detail below, client computing device 102 and server device 104 may be configured to send and receive data over network 106 with each other and/or with other devices of system 100 . Network 106 may be implemented as any number of various wired and/or wireless networks. For example, network 106 may be implemented as or otherwise include a wired or wireless local area network (LAN), a wired or wireless wide area network (WAN), a cellular network, and/or a publicly accessible global network such as the Internet. Accordingly, network 106 may include any number of additional devices, such as additional computers, routers, and switches, to facilitate communication between devices of system 100 .

Referring now to FIG. 2 , in an illustrative embodiment, client computing device 102 establishes environment 200 during operation. The illustrative environment 200 includes an application 202 , a license agent loader module 204 and a secure address space 206 . The various modules of environment 200 may be implemented as hardware, firmware, software, or a combination thereof. For example, various modules, logic, and other components of environment 200 may form part of, or otherwise be established by, processor 120 or other hardware components of client computing device 102 . Thus, in some embodiments, any one or more modules of environment 200 may be implemented as a circuit or collection of electrical devices (eg, license agent loader circuit, secure address space circuit, etc.).

Application 202 may be implemented as any user application, system application, module, script, or other computer program configured to access services or data provided by server device 104 . Application 202 may be implemented as a native application, a web application, bytecode, source code, or any other code executable by client computing device 102 . For example, application 202 may be implemented as a content application (eg, news portal, map application, travel guide, health portal, financial portal, etc.) that accesses data stored by server device 104 . As another example, application 202 may be implemented as a game that accesses game state maintained by server device 104 .

License agent loader module 204 is configured to load license agent 208 into secure address space 206 established by processor 120 of client computing device 102 . License agent loader module 204 may be included in or installed with application 202 . License proxy loader module 204 executes outside of secure address space 206 and thus may not be secure or otherwise authenticated by client computing device 102 .

Secure address space 206 is configured to provide an isolated and secure execution environment within environment 200 . In some embodiments, the secure address space 206 may be implemented as a software-based trusted execution environment; that is, a trusted execution environment that executes software securely using the processor 120 of the client computing device 102 . For example, secure address space 206 may be implemented as one or more secure address spaces established using secure address space support 122 of processor 120, such as using The secure address space established by SGX technology. Secure address space 206 also establishes license broker 208 . The illustrative license broker 208 includes an application request module 210 , an attestation module 212 , a user authentication module 214 , and a server access module 216 . The various modules and components of secure address space 206 may be implemented as hardware, firmware, software, or a combination thereof. For example, various modules, logic, and other components of the secure address space 206 may form part of or otherwise be constructed by the processor 120 or other hardware components of the client computing device 102 . Thus, in some embodiments, any one or more modules of secure address space 206 may be implemented as a circuit or collection of electrical devices (eg, license proxy circuit, application request circuit, attestation circuit, etc.).

The application request module 210 is configured to receive a request from the application 202 to access the remote server device 104 . The application request module 210 may be configured to open a secure connection with the remote server device 104 in response to receiving a request to access the remote server device 104 .

Attestation module 212 is configured to perform remote attestation of secure address space 206 to remote server device 104 using a secure connection between client computing device 102 and remote server device 104 . Remote attestation may include generating a measure of secure address space 206 and sending the measure to remote server device 104 . The measurement may be indicative of a security log associated with the secure address space 206, and the security log may be indicative of the contents of the secure address space 206 and the order in which the secure address space 206 was created.

User authentication module 214 is configured to authenticate a user of computing device 102 . User authentication module 214 may be configured to receive user credentials from a user, and in some embodiments may use a trusted I/O path of client computing device 102 to receive credentials.

The server access module 216 is configured to send the machine identifier and the user identifier to the remote server device 104 using a secure connection after authenticating the user. The server access module 216 is also configured to allow the application 202 to access the secure connection with the remote server device 104 after sending the machine identifier and the user identifier, and in some embodiments, receive a success response from the remote server device 104 . A machine identifier may be implemented as any type of data configured to securely and uniquely identify a particular computing device 102 . Server access module 216 may be configured to generate a machine identifier based on a unique key that is unique to a particular combination of secure address space 206 and client computing device 102 . For example, the unique key can be implemented as an address space sealing key. Similarly, a user identifier may be implemented as any credential or other type of data configured to identify a particular user of computing device 102 .

Still referring to FIG. 2 , in an illustrative embodiment, server device 104 establishes environment 220 during operation. The illustrative environment 220 includes an application 222 , an application license module 226 , a client computing device module 230 , a validation module 232 , and an access verification module 234 . The various modules of environment 220 may be implemented as hardware, firmware, software, or a combination thereof. For example, various modules, logic, and other components of environment 220 may form part of, or otherwise be established by, processor 140 or other hardware components of server device 104 . As such, in some embodiments, any one or more modules of environment 220 may be implemented as a circuit or collection of electrical devices (eg, application license circuits, client computing device circuits, etc.).

Application 222 may be implemented as any user application, system application, module, script, or other computer program configured to provide services or data to client computing device 102 . Applications 222 may be implemented as native applications, web applications, bytecode, source code, or any other code that may be executed by server device 104 . For example, application 222 may be implemented as a content portal, online game, or other application. As shown, application 222 may store, maintain, or otherwise access application data 224 , which may include content data, game state data, or other data used by application 222 .

The application license module 226 is configured to bind the machine identifier and the user identifier to the application license. As noted above, the machine identifier indicates the combination of a particular client computing device 102 and the secure address space 206 established by the processor 120 of the client computing device 102 . The machine identifier may be generated from a unique key that is unique to the combination of the client computing device 102 and the secure address space 206 of the client computing device 102 (eg, an address space sealing key). Application license module 226 may be configured to send the server challenge data item to client computing device 102, and the machine identifier may further indicate the server challenge data item. Application license module 226 may be configured to receive a machine identifier and a user identifier from client computing device 102 . The machine identifier and/or user identifier may be stored in or otherwise associated with license data 228 .

Client computing device module 230 is configured to open a secure connection with client computing device 102 after the machine identifier and user identifier are bound to the application license. As described further below, client computing device module 230 is configured to allow client computing device 102 to access application 222 and/or application data 224 using a secure connection after successfully remotely attesting to secure address space 206, and successfully authenticating The machine identifier and user identifier provided by the client computing device 102 .

The attestation module 232 is configured to perform remote attestation of the secure address space 206 of the client computing device 102 using a secure connection. Remote attestation may include receiving measurements of the secure address space 206 and verifying that the secure address space 206 is intact based on the measurements. The measure of secure address space 206 may indicate a security log associated with secure address space 206 , and the security log may indicate the contents of secure address space 206 and the order in which secure address space 206 was created.

The access verification module 234 is configured to receive the machine identifier and the user identifier from the client computing device 102 using a secure connection, and to verify the machine identifier and the user identifier. Access verification module 234 may be configured to determine whether the machine identifier and user identifier match the machine identifier and user identifier previously bound to the application license. As described above, following successful verification of the machine identifier and user identifier, client computing device 102 may access application 222 and/or application data 224 using a secure connection.

Referring now to FIG. 3 , in use, a client computing device 102 may perform a method 300 for secure server access. Method 300 begins at block 302 , where client computing device 102 installs trusted license agent 208 for application 202 . Trusted license agent 208 may be installed with or as part of application 202 . Code and/or data associated with trusted license agent 208 may be included in application 202 and may be transmitted and/or stored in an unprotected format (eg, without encryption).

In block 304 , the client computing device 102 loads the trusted license agent 208 into the secure address space 206 . After being loaded into secure address space 206, trusted license agent 208 may not be tampered with or otherwise accessed by unauthorized processes. Additionally, after loading into secure address space 206, a remote attestation process may be used to verify that trusted license agent 208 has not been altered, as described further below. In an illustrative embodiment, secure address space 206 remains open, and trusted license agent 208 remains loaded during execution of method 300 . However, in some embodiments, the trusted license agent 208 can be unloaded (e.g., encrypted and swapped to disk, or closed out of memory completely) and then securely reloaded into the secure address space as needed 206 in.

Client computing device 102 may load trusted license agent 208 into secure address space 206 using any suitable technique. For example, client computing device 102 may establish one or more secure address spaces within memory 126 using secure address space support 122 of processor 120 . can for example use SGX technology to establish a secure address space. To establish the secure address space, client computing device 102 may execute one or more processor instructions to create the secure address space, add memory pages to the secure address space, and perform measurements of the secure address space. As memory pages are added to the secure address space, secure address space support 122 may update the security log based on the contents of the memory pages and the order in which the memory pages were added. Completing the secure address space may generate measurements based on the secure log, for example by generating a secure hash value based on the secure log. After the secure address space is complete, additional memory pages may not be added to the secure address space. The measure of secure address space can be used to identify and distinguish between different secure address spaces established by the client computing device 102 .

In block 306 , the client computing device 102 binds the user identifier and the machine identifier to the license of the application 202 . A user identifier may be implemented as any user credential or other data that identifies a particular user of the client computing device. The user identifier may include an authentication factor, such as a password used to authenticate the user. A machine identifier may be implemented as any data that securely and uniquely identifies a particular client computing device 102 . The user identifier and machine identifier may be bound to the application license prior to execution of the application 202, eg, during installation of the application 202 or in another configuration process. In some embodiments, in block 308 the client computing device 102 may generate a machine identifier using the address space sealing key. The address space sealing key may be implemented as a secret encryption key embedded in the secure address space support 122 at the time of manufacture. Processor 120 may use an address space sealing key to encrypt data associated with secure address space 206 before the data leaves processor 120 . Machine identifiers can be generated as cryptographic hashes, signatures, derived keys, or other data derived from address space sealing keys. In some embodiments, the machine identifier may be generated as a cryptographic hash of the address space sealing key and server challenge data item received from the server device 104 . In block 310 , the client computing device 102 sends the machine identifier and/or the user identifier to the server device 104 .

In block 312 , the client computing device 102 monitors the application 202 for requests to access the server device 104 . Client computing device 102 may monitor requests to access server device 104 using any technique. For example, application 202 may issue a request to trusted license agent 208 of secure address space 206, eg, using a network request or other inter-process communication channel. As another example, trusted license proxy 208 of secure address space 206 may intercept requests made by application 202 . In block 314, the client computing device 102 determines whether the application 202 has generated a request. If not, the method 300 loops back to block 312 to continue monitoring requests. If a request to the server device 104 has been generated, the method 300 proceeds to block 316 .

In block 316 , the trusted license agent 208 of the client computing device 102 establishes a secure network connection with the server device 104 . The secure network connection allows the trusted license agent 208 executing within the secure address space 206 to communicate securely with the remote server device 104 . A secure network connection may be established using any suitable communication protocol or other technique. For example, a secure network connection can be established using the SSL/TLS protocol.

In block 318 , client computing device 102 performs remote validation of secure address space 206 with remote server device 104 . The remote attestation proves to server device 104 that trusted license agent 208 is executing in valid secure address space 206 and that trusted license agent 208 is authentic (ie, trusted license agent 208 has not been tampered with). To perform remote attestation, client computing device 102 may execute SGX technology secure address space remote attestation process.

In block 320 , the client computing device 102 generates a measure of the secure address space 206 . This measure may be implemented as a cryptographically secure value that depends on the contents of the memory pages added to the secure address space 206 and the order in which the memory pages were added to the secure address space 206 . For example, the measurement may be implemented as a cryptographic hash of a security log generated during construction of the secure address space 206 . Measurements may be generated using dedicated processor instructions of processor 120, for example as an EREPORT instruction. Measurements may also be bound to client computing device 102 hardware. For example, the measurement may include a message authentication code (MAC) generated using an encryption key (eg, a reporting key) associated with a particular secure address space established by the client computing device 102 . In some embodiments, client computing device 102 may replace the measured MAC with a signature created using a device-specific private key associated with client computing device 102 . After generating the measurements, in block 322 the client computing device 102 sends the measurements to the server device 104 via the secure network connection. As described further below, server device 104 may use measurements to verify that secure address space 206 is a valid secure address space and that trusted license agent 208 is authentic.

In block 324 , the client computing device 102 authenticates the user of the client computing device 102 . Authentication of users is performed by trusted license broker 208 from within secure address space 206 . After authenticating the user, client computing device 102 generates a user identifier, such as a user credential, associated with the authenticated user. Client computing device 102 may use any technique to authenticate the user. In some embodiments, in block 326 the client computing device 102 may receive user authentication data from an operating system or other common software of the client computing device 102 . For example, trusted license agent 208 may receive user authentication credentials or other authentication factors gleaned from interactive login prompts provided by the operating system. In these embodiments, the security of the user authentication process depends on the level of security provided by the operating system. Additionally or alternatively, in some embodiments, in block 328 the client computing device 102 may receive user authentication data using the protected I/O path. For example, client computing device 102 may receive authentication data from a trusted input device (eg, a trusted PIN pad). As another example, client computing device 102 may use a protected audio/video path (e.g., The PAVP) displays the scrambled PIN pad, and receives user input based on the scrambled PIN pad. In these embodiments, protected I/O paths may provide additional security beyond that provided by the operating system.

In block 330, the client computing device 102 sends the user identifier and the machine identifier to the server device 104 via the secure connection. As mentioned above, the user identifier is based on the result of user authentication. Similarly, the machine identifier uniquely identifies the client computing device 102, as described above. In some embodiments, the machine identifier may also identify the secure address space 206 and the trusted license broker 208 . As described further below, server device 104 may determine whether the particular combination of user and machine described by the user identifier and machine identifier is permitted to access application 222 and/or application data 224 maintained by server device 104 .

In block 332 , the client computing device 102 receives a response from the server device 104 indicating whether access to the application 222 and/or application data 224 is permitted. In block 334 , the client computing device 102 determines whether access is permitted based on the response from the server device 104 . If not, the method 300 loops back to block 312 to continue monitoring for requests to access the server device 104 . If access has been allowed, method 300 proceeds to block 336 . In block 336, the client computing device 102 allows the application 202 to access the server device 104 using the secure network connection. Application 202 may make requests to and receive data from server device 104 over a secure network connection established by trusted license broker 208 . After allowing access to the secure network connection, the method 300 loops back to block 312 to continue monitoring for requests to access the server device 104 .

Referring now to FIG. 4, in use, the server device 104 may perform a method 400 for secure server access. Method 400 begins at block 402 , where server device 104 binds a machine identifier and a user identifier to a license of application 202 executed by client computing device 102 . Server device 104 may associate a particular combination of user identifier and machine identifier with an application license, such as by storing the user identifier and machine identifier in license data 228 . As noted above, a user identifier may be implemented as any user credentials or other data that identifies a particular user of client computing device 102 . A machine identifier may be implemented as any data that securely and uniquely identifies a particular client computing device 102 . In some embodiments, the machine identifier may also identify the secure address space 206 and the license broker 208 of the client computing device 102 . For example, the machine identifier may be derived from an address space sealing key embedded in the secure address space support 122 of the client computing device 102 at the time of manufacture or otherwise based on a secure address space support 122 embedded in the client computing device 102 at the time of manufacture. The address space supports 122 the address space sealing key. In some embodiments, server device 104 may bind the user identifier and machine identifier to the application license prior to servicing any requests from client computing device 102, eg, as part of a provisioning process. Additionally or alternatively, server device 104 may communicate with client computing device 102 to bind the user identifier and the machine identifier to the application license.

In some embodiments, the server device 104 may send the server challenge data item to the client computing device 102 in block 404 . The challenge data item can be implemented as any timestamp, random number, random value, or other value known to server device 104, and can be used to prevent replay attacks. A machine identifier may be generated from a server challenge data item. For example, the machine identifier may be implemented as a cryptographic hash of the server challenge data item and an address space sealing key for the client computing device 102 . In some embodiments, the server device 104 may receive the machine identifier and/or the user identifier from the client computing device 102 in block 406 . Additionally or alternatively, in some embodiments, server device 104 may be configured with or receive machine identifiers and/or user identifiers from a different source (eg, an enterprise directory server).

In block 408 , the server device 104 listens for the secure network connection opened by the client computing device 102 . In block 410, the server device 104 determines whether a secure connection with the client computing device 102 has been opened. If not, method 400 loops back to block 408 to continue monitoring the secure connection. If a secure connection has been opened, method 400 proceeds to block 412 .

In block 412 , server device 104 performs remote attestation to client computing device 102 . As described above, remote attestation allows the server device 104 to verify that the trusted license agent 208 executed by the client computing device 102 is executing in a valid secure address space 206 and that the trusted license agent 208 is authentic (i.e., the trusted license agent 208 has not been tampered with). To perform remote attestation, server device 104 may execute SGX technology secure address space remote attestation process.

In block 414 , the server device 104 receives the measurement of the secure address space 206 from the client computing device 102 . As described above, this measure may be implemented as a security value that depends on the contents of the memory pages added to the secure address space 206 and the order in which the memory pages were added to the secure address space 206 . For example, the measurement may be implemented as a cryptographic hash of a security log generated during construction of the secure address space 206 . The measurements may be generated using dedicated processor instructions of the processor 120 of the client computing device 102, such as the EREPORT instruction. Measurements may also be bound to client computing device 102 hardware. For example, the measurement may include a message authentication code (MAC) generated using an encryption key (eg, a reporting key) associated with a particular secure address space established by the client computing device 102 . In some embodiments, client computing device 102 may replace the measured MAC with a signature created using a device-specific private key associated with client computing device 102 . After receiving the measurements in block 416, the server device 104 verifies whether the secure address space is intact based on the measurements. For example, server device 104 may compare message authentication codes, signatures, or other data included in the measurements to expected values.

In block 418, the server device 104 determines whether the secure address space 206 of the client computing device 102 was successfully authenticated. If not, method 400 loops back to block 408 to listen for additional secure connections. In some embodiments, server device 104 may close the secure connection, send a negative response to client computing device 102 , log an error, or perform any other appropriate security response based on failure to verify secure address space 206 . If the secure address space 206 is successfully verified, the method 400 proceeds to block 420 .

In block 420 , the server device 104 receives the machine identifier and the user identifier from the client computing device 102 . As noted above, the machine identifier uniquely describes a particular client computing device 102 and may be bound to the hardware of the client computing device 102, such as by being derived from an address space sealing key. The user identifier describes a currently authenticated user of the client computing device 102 and may include or be derived from user authentication factors (eg, user credentials).

In block 422, the server device 104 verifies the application license based on the machine identifier and the user identifier. Server device 104 may determine whether a particular combination of machine identifier and user identifier is authorized to access application 222 and/or application data 224 . Server device 104 may search license data 228 using, for example, a machine identifier and/or a user identifier. In block 424, the server device 104 determines whether the application license has been verified. If not, method 400 loops back to block 408 to listen for additional secure connections. In some embodiments, server device 104 may close the secure connection, send a negative response to client computing device 102 , log an error, or perform any other appropriate security response based on failure to verify the application license. If the application license is successfully verified, the method 400 proceeds to block 426 .

In block 426, the server device 104 allows the client computing device 102 to access the application 222 and/or the application data 224 using the secure network connection. Data sent to client computing device 102 is sent protected by a secure network connection. Client computing device 102 may continue to access application 222 and/or application data 224 using the secure network connection during the life of the application session. After allowing client computing device 102 to access application 222 and/or application data 224, method 400 loops back to block 408 to listen for additional secure connections.

example

Illustrative examples of the techniques disclosed herein are provided below. An embodiment of the technique may include any one or more and any combination of the examples described below.

Example 1 includes a computing device for secure server access, the computing device comprising: a processor including secure address space support; a license agent loader module for loading a license agent into the secure address space; an application request module for receiving, by the license agent, a request from an application of the computing device to access a remote server; a validation module, executed by the license agent via a secure connection between the license agent and the remote server remote attestation of a secure address space to a remote server; a user authentication module for authenticating, by the license agent, a user of the computing device; and a server access module for (i) responsive to authentication of the user, by the The license agent sends a machine identifier and a user identifier to a remote server via the secure connection, wherein the machine identifier identifies the computing device and the user identifier identifies a user of the computing device; and (ii ) allowing, by the license agent, an application to access a secure connection with a remote server in response to authentication of the machine identifier and user identifier.

Example 2 includes the subject matter of Example 1, and wherein the application request module opens, by the license agent, a secure connection with the remote server further in response to receiving a request to access the remote server.

Example 3 includes the subject matter of any one of Examples 1 and 2, and wherein the server access module further receives, by the license agent, a success response from the remote server in response to sending the machine identifier and the user identifier; wherein the application is allowed to respond Accessing the secure connection upon authentication of the machine identifier and user identifier includes allowing the application to access the secure connection in response to receiving the success response.

Example 4 includes the subject matter of any of Examples 1-3, and wherein the server access module further generates, by the license agent, a machine identifier based on a unique key, wherein the unique key is unique to a combination of the secure address space and the computing device .

Example 5 includes the subject matter of any of Examples 1-4, wherein the unique key comprises an address space sealing key.

Example 6 includes the subject matter of any of Examples 1-5, and wherein generating the machine identifier further comprises generating the machine identifier from a server challenge data item received from the remote server.

Example 7 includes the subject matter of any of Examples 1-6, and wherein performing the remote attestation of the secure address space includes generating, by the license agent, a measure of the secure address space; and sending, by the license agent, the measure of the secure address space to the remote server.

Example 8 includes the subject matter of any of Examples 1-7, and wherein generating the measure of the secure address space comprises generating a measure indicative of a secure log associated with the secure address space, wherein the secure log indicates the contents of the secure address space and The order in which secure address spaces are created.

Example 9 includes the subject matter of any of Examples 1-8, and wherein authenticating the user of the computing device includes receiving user credentials from the user.

Example 10 includes the subject matter of any of Examples 1-9, and wherein receiving the user credentials from the user includes receiving the user credentials using a trusted I/O path of the computing device.

Example 11 includes a computing device for secure server access, the computing device including an application license module that binds a first machine identifier and a first user identifier to an application license, wherein the first machine identifier identifies a specific combination of a client computing device and a secure address space established by a processor of the client computing device, and the first user identifier identifies a specific user of the client computing device; a client computing device module for Opening a secure connection with the client computing device; an attestation module for performing remote attestation of the client computing device's secure address space via the secure connection; and an access verification module for (i) via The secure connection receives a second machine identifier and a second user identifier from the client computing device, and (ii) determines whether the second machine identifier matches the first machine identifier and the second whether the user identifier matches the first user identifier; wherein the client computing device module is further operable to respond to (i) performance of remote attestation of the secure address space and (ii) matching of the second machine identifier to A determination that the first machine identifier matches and that the second user identifier matches the first user identifier allows the client computing device to access data of the computing device via the secure connection.

Example 12 includes the subject matter of Example 11, and wherein allowing the client computing device to access the data includes sending a success response to the client computing device.

Example 13 includes the subject matter of any of Examples 11 and 12, and wherein the first machine identifier is generated from a unique key that is specific to the client computing device and the secure address of the client computing device The combination of spaces is unique.

Example 14 includes the subject matter of any of Examples 11-13, and wherein the unique key comprises an address space sealing key.

Example 15 includes the subject matter of any of Examples 11-14, and wherein binding the first machine identifier and the first user identifier to the application license includes receiving the first machine identifier and the first user identifier from the client computing device identifier.

Example 16 includes the subject matter of any of Examples 11-15, and wherein binding the first machine identifier and the first user identifier to the application license includes sending a server challenge data item to the client computing device, wherein the machine The identifier further instructs the server to challenge the data item.

Example 17 includes the subject matter of any of Examples 11-16, and wherein performing the remote attestation of the secure address space of the client computing device comprises receiving a measure of the secure address space via the secure connection; and based on the measure of the secure address space, Verify that the secure address space is intact.

Example 18 includes the subject matter of any of Examples 11-17, and wherein the measurement of the secure address space indicates a security log associated with the secure address space, wherein the security log indicates contents of the secure address space, and creating the secure address space order of space.

Example 19 includes a method for secure server access, the method comprising loading, by a computing device, a license agent into a secure address space established by a processor of the computing device; receiving, by the license agent, access to the remote server from an application of the computing device performing a remote attestation of the secure address space to the remote server by the license agent via a secure connection between the license agent and the remote server; authenticating the user of the computing device by the license agent; in response to The user authenticates, the license agent sends a machine identifier and a user identifier to the remote server over the secure connection, wherein the machine identifier identifies the computing device and the user identifier identifies the a user of the computing device; and allowing, by the license agent, an application to access a secure connection with the remote server in response to authenticating the machine identifier and the user identifier.

Example 20 includes the subject matter of Example 19, and further includes opening, by the license agent, a secure connection with the remote server in response to receiving a request to access the remote server.

Example 21 includes the subject matter of any one of Examples 19 and 20, and further includes receiving, by the license agent, a success response from the remote server in response to sending the machine identifier and the user identifier; wherein in response to authenticating the machine identifier and the user identifier Allowing the application to access the secure connection in response to receiving the success response includes allowing the application to access the secure connection.

Example 22 includes the subject matter of any of Examples 19-21, and further includes the machine identifier generated by the license agent based on the unique key, where the unique key is unique to the combination of the secure address space and the computing device.

Example 23 includes the subject matter of any of Examples 19-22, and wherein the unique key comprises an address space sealing key.

Example 24 includes the subject matter of any of Examples 19-23, and wherein generating the machine identifier further comprises generating the machine identifier from a server challenge data item received from the remote server.

Example 25 includes the subject matter of any of Examples 19-24, and wherein performing the remote attestation of the secure address space includes generating, by the license agent, a measure of the secure address space; and sending, by the license agent, the measure of the secure address space to the remote server.

Example 26 includes the subject matter of any of Examples 19-25, and wherein generating the measure of the secure address space comprises generating a measure indicative of a secure log associated with the secure address space, wherein the secure log indicates the contents of the secure address space and The order in which secure address spaces are created.

Example 27 includes the subject matter of any of Examples 19-26, and wherein authenticating the user of the computing device includes receiving user credentials from the user.

Example 28 includes the subject matter of any of Examples 19-27, and wherein receiving the user credentials from the user includes receiving the user credentials using a trusted I/O path of the computing device.

Example 29 includes a method for securing server access, the method comprising binding, by the computing device, a first machine identifier and a first user identifier to an application license, wherein the first machine identifier identifies the client computing device and a specific combination of a secure address space established by a processor of a client computing device, and wherein the first user identifier identifies a specific user of the client computing device; opened by the computing device to communicate with the client a secure connection to a computing device; performing, by the computing device via the secure connection, remote attestation of the secure address space by the client computing device; computing from the client via the secure connection by the computing device receiving a second machine identifier and a second user identifier at the device; determining, by the computing device, whether the second machine identifier matches the first machine identifier and whether the second user identifier matches the first a user identifier matches; and in response to (i) performing a remote attestation of the secure address space, and (ii) determining that the second machine identifier matches the first machine identifier and that the second user The identifier matches the first user identifier, and the computing device allows the client computing device to access data of the computing device via the secure connection.

Example 30 includes the subject matter of Example 29, and wherein allowing the client computing device to access the data includes sending a success response to the client computing device.

Example 31 includes the subject matter of any of Examples 29 and 30, and wherein the first machine identifier is generated based on a unique key that is specific to the client computing device and the secure address space of the client computing device Combinations are unique.

Example 32 includes the subject matter of any of Examples 29-31, and wherein the unique key comprises an address space sealing key.

Example 33 includes the subject matter of any of Examples 29-32, and wherein binding the first machine identifier and the first user identifier to the application license includes receiving the first machine identifier and the first user identifier from the client computing device identifier.

Example 34 includes the subject matter of any of Examples 29-33, and wherein binding the first machine identifier and the first user identifier to the application license includes sending a server challenge data item to the client computing device, wherein the machine identifier Further instructs the server to challenge the data item.

Example 35 includes the subject matter of any of Examples 29-34, and wherein performing the remote attestation of the secure address space of the client computing device comprises: receiving a measure of the secure address space via the secure connection; and based on the measure of the secure address space to verify that the secure address space is intact.

Example 36 includes the subject matter of any of Examples 29-35, wherein the measurement of the secure address space indicates a security log associated with the secure address space, wherein the security log indicates content of the secure address space and creation of the secure address space order.

Example 37 includes a computing device comprising a processor; and a memory having stored therein a plurality of instructions that, when executed by the processor, cause the computing device to perform the method of any one of Examples 19-36.

Example 38 includes one or more machine-readable storage media comprising a plurality of instructions stored thereon that, in response to execution of the instructions, cause a computing device to perform the method of any one of Examples 19-36.

Example 39 includes a computing device comprising means for performing the method of any of Examples 19-36.

Example 40 includes a computing device for secure server access, the computing device comprising: means for loading a license agent into a secure address space established by a processor of the computing device; A unit for receiving a request for access to a remote server by the license agent from an application of the computing device; a unit for performing remote attestation of the secure address space to the remote server by the license agent via a secure connection between the license agent and the remote server; means for authenticating a user of the computing device by the license agent; for sending, by the license agent, a machine identifier and a user identifier to the remote server via a secure connection in response to authenticating the user means for wherein the machine identifier identifies the computing device and the user identifier identifies a user of the computing device; and for allowing an application, by a license agent, to A unit to access a secure connection to a remote server.

Example 41 includes the subject matter of Example 40, and further includes means for opening, by the license agent, a secure connection with the remote server in response to receiving a request to access the remote server.

Example 42 includes the subject matter of any one of Examples 40 and 41, and further includes means for receiving, by the license agent, a success response from the remote server in response to sending the machine identifier and the user identifier; wherein in response to authenticating the machine The means for allowing the application to access the secure connection using the identifier and the user identifier includes means for allowing the application to access the secure connection in response to a successful response.

Example 43 includes the subject matter of any of Examples 40-42, and further includes means for generating, by the license agent, a machine identifier based on a unique key that is unique to the combination of the secure address space and the computing device of.

Example 44 includes the subject matter of any of Examples 40-43, and wherein the unique key comprises an address space sealing key.

Example 45 includes the subject matter of any of Examples 40-44, and wherein the means for generating the machine identifier further comprises means for generating the machine identifier from a server challenge data item received from the remote server.

Example 46 includes the subject matter of any of Examples 40-45, and wherein the means for performing remote attestation of the secure address space comprises means for generating, by the license agent, a measure of the secure address space; A means for an authentication agent to send a measure of a secure address space to a remote server.

Example 47 includes the subject matter of any of Examples 40-46, and wherein the means for generating a measure of the secure address space comprises means for generating a measure indicative of a secure log associated with the secure address space, wherein the secure log Indicates the contents of the secure address space and the order in which the secure address space is created.

Example 48 includes the subject matter of any of Examples 40-47, and wherein the means for authenticating a user of the computing device includes means for receiving user credentials from the user.

Example 49 includes the subject matter of any of Examples 40-48, and wherein the means for receiving user credentials from the user comprises means for receiving user credentials using a trusted I/O path of the computing device.

Example 50 includes a computing device for secure server access, the computing device comprising: means for binding a first machine identifier and a first user identifier to an application license, wherein the first machine identifier identifies a specific combination of a client computing device and a secure address space established by a processor of the client computing device, and wherein the first user identifier identifies a specific user of the client computing device; means for a secure connection of the client computing device; means for performing remote attestation of a secure address space of the client computing device via the secure connection; for computing from the client computing device via the secure connection means for receiving a second machine identifier and a second user identifier; for determining whether the second machine identifier matches the first machine identifier and whether the second user identifier matches the first means for user identifier matching; and means for performing remote attestation of the secure address space in response to (i) and (ii) determining that the second machine identifier matches the first machine identifier and the second user identifier matches the The first user identifier matches to allow the client computing device to access elements of the computing device's data via the secure connection.

Example 51 includes the subject matter of Example 50, and wherein the means for allowing the client computing device to access the data comprises means for sending a success response to the client computing device.

Example 52 includes the subject matter of any one of Examples 50 and 51, and wherein the first machine identifier is generated from a unique key, wherein the unique key for a combination of the client computing device and the secure address space of the client computing device is only.

Example 53 includes the subject matter of any of Examples 50-52, and wherein the unique key comprises an address space sealing key.

Example 54 includes the subject matter of any of Examples 50-53, and wherein the means for binding the first machine identifier and the first user identifier to the application license comprises receiving the first machine identification from the client computing device symbol and the unit of the first user identifier.

Example 55 includes the subject matter of any of Examples 50-54, and wherein the means for binding the first machine identifier and the first user identifier to the application license comprises sending a server challenge data item to the client The element of computing device, wherein the machine identifier further instructs the server to challenge the data item.

Example 56 includes the subject matter of any of Examples 50-55, and wherein the means for performing remote verification of the secure address space of the client computing device comprises means for receiving a measure of the secure address space via the secure connection; and Used to verify that the secure address space is a sound unit based on measurements of the secure address space.

Example 57 includes the subject matter of any of Examples 50-56, wherein the measurement of the secure address space is indicative of a security log associated with the secure address space, wherein the security log is indicative of content of the secure address space and creation of the secure address space order.

Claims (25)

1. a kind of computing device accessed for security server, the computing device include：

Processor, it includes safe address space and supported；

Licence broker loader module, for licence broker to be loaded into safe address space；

Application request module, remote server is accessed for being received by the licence broker from the application of the computing device Request；

Module is confirmed, is connected by the licence broker via the safety between the licence broker and the remote server Fetch the long-range confirmation for performing the safe address space to the remote server；

User authentication module, the user for the computing device as described in the licence broker certification；And

Server access module, for (i) by the licence broker in response to the certification to the user and by machine identification Symbol and user identifier are sent to the remote server via the secure connection, wherein described in machine identifier mark Computing device, and the user identifier identifies the user of the computing device；And (ii) by the licensing generation Reason allows the application to access and the long-range clothes in response to the certification to the machine identifier and the user identifier The secure connection of business device.

2. computing device according to claim 1, wherein：

The server access module is further used for by the licence broker in response to the machine identifier and described The transmission of user identifier and from the remote server receive success response；

Wherein, the application is allowed to access the peace in response to the certification to the machine identifier and the user identifier Full connection includes：The application is allowed to access the secure connection in response to the reception to the success response.

3. computing device according to claim 1, wherein, the server access module is further used for by the license Card agency generates the machine identifier according to unique key, wherein, the unique key includes empty for the safe address Between and the combination of the computing device be unique address space sealed key.

4. computing device according to claim 3, wherein, generating the machine identifier is also included according to from described long-range The server-challenge data item that server receives generates the machine identifier.

5. according to the computing device any one of claim 1-4, wherein, the long-range card of the execution safe address space Include in fact：

The measurement of the safe address space is generated by the licence broker, wherein, the measurement instruction and the security bit The security log of location space correlation connection, wherein, the security log indicates the content of the safe address space and the safety The establishment order of address space；And

The measurement of the safe address space is sent to the remote server by the licence broker.

6. according to the computing device any one of claim 1-4, wherein, the user bag of computing device described in certification Include and receive user's voucher from the user using the trusted I/O paths of the computing device.

7. a kind of computing device accessed for security server, the computing device include：

Using licensing module, for the first machine identifier and the first user identifier to be tied to using licensing, wherein The first machine identifier mark client computing device and the safety established by the processor of the client computing device The particular combination of address space, and first user identifier identifies the specific user of the client computing device；

Client computing device module, for opening the secure connection with the client computing device；

Module is confirmed, for performing the safe address space of the client computing device via the secure connection It is long-range to confirm；And

Authentication module is accessed, the second machine identification is received from the client computing device via the secure connection for (i) Symbol and second user identifier, and (ii) determine second machine identifier whether with first machine identifier Match somebody with somebody, and the second user identifier whether with first subscriber identifier matches；

Wherein described client computing device module is further used in response to the long-range confirmation of safe address space (i) described Perform and (ii) described second machine identifier is matched with first machine identifier and the second user identifier With the determination of first subscriber identifier matches, and allow the client computing device via the secure connection access institute State the data of computing device.

8. computing device according to claim 7, wherein, it is allowed to the client computing device, which accesses the data, to be included Success response is sent to the client computing device.

9. computing device according to claim 7, wherein, first machine identifier is generated according to unique key , wherein the unique key includes the security bit for the client computing device and the client computing device The combination in location space is unique address space sealed key.

10. computing device according to claim 7, wherein, first machine identifier and first user are marked Knowing symbol and being tied to the application licensing includes receiving first machine identifier and described from the client computing device First user identifier.

11. computing device according to claim 7, wherein, first machine identifier and first user are marked Know symbol and be tied to the application licensing including server-challenge data item is sent into the client computing device, wherein institute State machine identifier and further indicate the server-challenge data item.

12. according to the computing device any one of claim 7-11, wherein, perform the institute of the client computing device Stating the long-range confirmation of safe address space includes：

The measurement of the safe address space, the measurement instruction and the safe address space are received via the secure connection Associated security log, wherein, the security log indicates that the content of the safe address space and the safe address are empty Between establishment order；And

Measuring to verify that the safe address space is intact based on the safe address space.

13. a kind of method accessed for security server, methods described include：

Licence broker is loaded into the safe address space by the processor foundation of the computing device by computing device；

The request for accessing remote server is received from the application of the computing device by the licence broker；

Performed by the licence broker via the secure connection between the licence broker and the remote server Long-range confirmation of the safe address space to the remote server；

The user of computing device as described in the licence broker certification；

By the licence broker in response to being authenticated to the user and by machine identifier and user identifier via institute State secure connection and be sent to the remote server, wherein the machine identifier identifies the computing device, and the use Family identifier identifies the user of the computing device；And

Allow described answer in response to the certification to the machine identifier and the user identifier by the licence broker With the secure connection accessed with the remote server.

14. according to the method for claim 13, in addition to by the licence broker according to unique key generate the machine Device identifier, wherein, the combination that the unique key includes for the safe address space and the computing device is unique Address space sealed key.

15. according to the method for claim 14, wherein, generating the machine identifier also includes remotely taking according to from described The server-challenge data item that business device receives generates the machine identifier.

16. according to the method for claim 13, wherein, performing the long-range confirmation of the safe address space includes：

The measurement of the safe address space, the measurement instruction and the safe address space are generated by the licence broker Associated security log, wherein, the security log indicates that the content of the safe address space and the safe address are empty Between establishment order；And

The measurement of the safe address space is sent to the remote server by the licence broker.

17. according to the method for claim 13, wherein, the user of computing device described in certification sets including the use of the calculating Standby trusted I/O paths receive user's voucher from the user.

18. a kind of method accessed for security server, methods described include：

The first machine identifier and the first user identifier are tied to using licensing by computing device, wherein first machine Device identifier identifies client computing device and the safe address space established by the processor of the client computing device Particular combination, and wherein described first user identifier identifies the specific user of the client computing device；

Secure connection with the client computing device is opened by the computing device；

The safe address space of the client computing device is performed via the secure connection by the computing device Long-range confirmation；

By the computing device the second machine identifier and the are received via the secure connection from the client computing device Two user identifiers；

Determine whether second machine identifier matches and described with first machine identifier by the computing device Second user identifier whether with first subscriber identifier matches；And

Perform the long-range confirmation of the safe address space in response to (i), and (ii) determine second machine identifier with The first machine identifier matching and the second user identifier and first subscriber identifier matches, the calculating Equipment allows data of the client computing device via the secure connection access computing device.

19. according to the method for claim 18, wherein, first machine identifier is generated according to unique key , wherein the unique key includes the security bit for the client computing device and the client computing device The combination in location space is unique address space sealed key.

20. the method according to claim 11, wherein, by first machine identifier and first user identifier Being tied to the application licensing includes receiving first machine identifier and described first from the client computing device User identifier.

21. the method according to claim 11, wherein, by first machine identifier and first user identifier Being tied to the application licensing includes server-challenge data item being sent to the client computing device, wherein the machine Device identifier further indicates the server-challenge data item.

22. according to the method for claim 18, wherein, perform the safe address space of the client computing device Long-range confirmation include：

The measurement of the safe address space, the measurement instruction and the safe address space are received via the secure connection Associated security log, wherein, the security log indicates that the content of the safe address space and the safe address are empty Between establishment order；And

Measuring to verify that the safe address space is intact based on the safe address space.

23. a kind of computing device, including：

Processor；With

Memory, there is the multiple instruction being stored thereon, the instruction is when by setting the calculating during computing device The standby method performed according to any one of claim 13-22.

24. one or more machinable mediums, including the multiple instruction being stored thereon, the instruction is in response to being held Go and cause method of the computing device according to any one of claim 13-22.

25. a kind of computing device, including for performing the module of the method according to any one of claim 13-22.